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(57) ABSTRACT 

A system and method for proactively detecting cloning fraud 
in a cellular mobile telephone environment are discussed. 
Information is collected which corresponds to registration 
notifications of the cellular telephones as they operate within 
the cellular mobile telephone environment. The registration 
information is used to detect time-space peculiarities. 
Specifically, registrations having the same mobile identifi- 
cation number and occurring in different mobile switching 
centers within a predetermined time interval are identified. 
This time interval, based on a reasonable travel time 
between cells covered by the different mobile switching 
centers where the registrations originated, is used as a 
threshold for detecting cloning fraud. 

20 Claims, 6 Drawing Sheets 
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SYSTEM AND METHOD FOR DETECTING 
CLONING FRAUD IN CELLULAR/PCS 
COMMUNICATIONS 

BACKGROUND OF THE INVENTION 

1. Field of the Invention 

The present invention relates generally to cellular/PCS 
(Personal Communications Services) telephone communi- 
cations. Specifically, the present invention relates to detect- 
ing cloning fraud in a cellular/PCS environment. 

2. Related Art 

Cellular mobile telephone systems provide direct-dial 
telephone service to mobile users by using radio transmis- 
sion. The service area of a cellular mobile telephone system 
is divided into regions called cells. Within each cell is a base 
station which includes a transmitter and a receiver. Each 
base station is connected to a mobile switching center 
(MSC) which processes calls to and from mobile users 
located in the cell. Each transmitter and receiver operates on 
a voice channel (frequency). A single channel may be used 
for many simultaneous conversations (voice signals) in cells 
which are sufficiently separated from one another such that 
excessive interference is avoided. However, as the number 
of mobile users increases within a cell, the cell may become 
too crowded to provide adequate separation. When a cell 
becomes overcrowded, the cell must be split into smaller 
cells with each cell covering a smaller geographic area. Each 
new cell requires a new base station which is connected to 
the original MSC. Thus, as the number of cells increases, 
each MSC may be processing calls for multiple cells. 

As a mobile user travels with his cellular telephone 
powered up, the cellular telephone autonomously registers 
the mobile user by sending signals with information iden- 
tifying the mobile user to the MSC serving the cell where the 
mobile user is currently located. The sending and receipt of 
such information is referred to as registration notification. 
The information included in a registration notification is the 
mobile user's mobile identification number (MIN) and an 
electronic serial number (ESN). The MIN uniquely identi- 
fies each mobile user in a manner similar to a conventional 
telephone number. The ESN is encoded into each cellular 
telephone. The ESN functions as a security password veri- 
fying the validity of the MIN and allowing the mobile user 
access to the cellular mobile telephone system. 

The MSC collects registration notifications and provides 
them to other facilities in the cellular mobile telephone 
system. These facilities primarily use the registration noti- 
fications to facilitate incoming and outgoing calls. Typically, 
a mobile user subscribes for services with the MSC covering 
the cell, or group of cells, where the mobile user primarily 
resides or conducts business. This MSC is referred to as the 
mobile user's home MSC. All other MSCs in the cellular 
mobile telephone system are known as visited MSCs with 
respect to the mobile user. When a mobile user ventures 
beyond the cells covered by the home MSC, the mobile user 
is said to be "visiting." For purposes of this discussion, a 
mobile user inside a cell of a visited MSC is referred to as 
a visiting mobile user. 

When a mobile user powers on his cellular telephone or 
crosses cell boundaries covered by different MSCs, the 
cellular telephone, at some point, autonomously sends a 
signal representing a registration notification. The MSC 
covering the cell (i.e., either a home MSC or a visited MSC) 
receives the registration notification. Based on the MIN and 
ESN contained in the registration notification, the MSC 
queries a Roamer Validation and Call Delivery (RVCD) 
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facility to validate the mobile user's subscription informa- 
tion. The RVCD stores the subscription information for all 
mobile users in the cellular mobile telephone system in a 
Home Location Register (HLR). The HLR identifies each of 
5 the mobile users home MSC, the services to which each 
mobile user is subscribed, and whether each subscription is 
valid. 

After receiving a query from the MSC, the RVCD 
responds by sending the requested the information included 

10 in the HLR back to the querying MSC. The MSC maintains 
this information to provide cellular mobile telephone ser- 
vices to the mobile user as long as the mobile user remains 
in cells covered by the MSC. 

Registration notification is important for several reasons. 
Primarily, registration notification is used to provide cellular 
mobile telephone services to mobile users outside of the 
cells of the home MSC (as described above). Thus, a mobile 
user can utilize cellular mobile telephone services through- 
out the cellular mobile telephone system. 

2Q Registration notification is also important for routing 
incoming calls to mobile users. When an incoming call is to 
be routed to a mobile user, the mobile user must be located 
so that the call can be routed through the proper MSC to the 
mobile user. In the case of a conventional telephone user 

25 (i.e., not a mobile user) attempting to place a call to a mobile 
user, the home MSC receives the incoming call from the 
regular telephone user and determines whether the mobile 
user is active, or operating, in the cell of the home MSC. If 
the mobile user is not active within the cell of the home 

30 MSC, the mobile user may: 1) not have his telephone 
powered up, or 2) be active in the cell of a visited MSC. In 
the first case, the incoming call cannot be routed to the 
mobile user. In the second case, the RVCD attempts to locate 
the mobile user within the cellular telephone system. 

35 The RVCD functions as a clearing house for a cellular 
mobile telephone system. Specifically, the RVCD validates 
mobile users and manages activation, deactivation, and 
changes in subscription profiles of mobile users. The RVCD 
also stores a copy of each registration notification received 

40 from the MSCs. Furthermore, the RVCD updates the HLR 
to indicate the MSC where the latest registration notification 
originated (this is called the originating MSC). This allows 
the RVCD to track where each mobile user is currently 
located in the cellular mobile telephone system. 

45 Tracking mobile users within the cellular mobile tele- 
phone system serves to facilitate the routing of incoming 
calls to mobile users. When an incoming call is placed to a 
mobile user who is not within the cell of the home MSC, the 
home MSC can query the RVCD to locate the mobile user 

50 based on the origination of the registration notification 
maintained in the HLR, The the incoming call can then be 
routed to the originating MSC which connects the incoming 
call via radio communication signals to the mobile user. In 
the preferred embodiment, two RVCD systems are used in 

55 parallel to provide backup for the cellular mobile telephone 
system in case one RVCD should fail. 

A problem existing in current cellular mobile telephone 
systems is cloning fraud. Cloning fraud occurs when one 
mobile user (called an unauthorized user) obtains and 

60 fraudulently uses the MIN and ESN registered to another 
mobile user (called an authorized user) in order to obtain 
"free" service. As used herein, the term "valid MIN" refers 
to a MIN when being used by an authorized mobile user. The 
term "cloned MIN" refers to a MIN when being used by an 

65 unauthorized mobile user. 

The cellular mobile telephone system uses the MIN and 
ESN associated with each mobile telephone call to bill the 
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authorized mobile user registered with that MIN and ESN. 
When a MIN and ESN are "cloned", the authorized mobile 
user gets billed for calls made with the valid MIN as well as 
those calls made using the cloned MIN. Cloning fraud costs 
the cellular telephone industry millions of dollars in lost 
revenue each year. What is needed is a means for detecting 
cloning fraud in a cellular/PCS environment. 

SUMMARY OF THE INVENTION 

The present invention is directed to a system 200 and 
method for proactive ly detecting cloning fraud in a cellular/ 
PCS (Personal Communications Services) environment. 
According to the invention, the system detects cloning fraud 
by comparing the time and location of registration notifica- 
tions having the same mobile identification number (MIN). 
Cloning fraud is reported when the computed time differ- 
ence between such registration notifications is less than a 
reasonable travel time between the cells of the originating 
mobile switching centers (originating MSCs). 

Further features and advantages of the present invention, 
as well as the structure and operation of various embodi- 
ments of the present invention, are described in detail below 
with reference to the accompanying drawings. 

BRIEF DESCRIPTION OF THE DRAWINGS 

The present invention is described with reference to the 
accompanying drawings. In the drawings, like reference 
numbers indicate identical or functionally similar elements. 



Call Delivery system (RVCD) 204A, a second RVCD 204B, 
a plurality of MSCs 120, and a plurality of mobile users 130. 
As discussed above, a base station (not shown) is positioned 
in each cell 110. Each base station is connected to a MSC 
120. An MSC 120 may be connected to one or more base 
stations thus covering one or more cells 110. Each of the 
MSCs 120 is connected to either RVCD 204A or RVCD 
204B, which are centrally located within cellular mobile 
telephone system 200, The RVCDs 204 are connected to 
each other to provide rerouting in the event that one fails. 
Both RVCDs 204 are connected to PSMS 202 which is also 
centrally located within cellular mobile telephone system 
200, In the preferred embodiment, the MSCs 120 are con- 
nected to the RVCDs 204 using IS-41 protocol over SS7 or 
X.25. The RVCDs 204 are connected to the PSMS 202 via 
an X.25 packet network, A person skilled in the art will 
recognize that other connection protocols and networks may 
alternatively be used. 

In general, a mobile user 130 registers with a MSC 120 by 
sending its MIN and ESN using well known wireless 
communication techniques (i.e., via a radio signal 220). 
Radio signal 220 containing mobile user's MIN and ESN is 
sent at a predetermined time interval while the mobile user 
130 is operating to notify the MSC 120 of its presence within 
the cell 110 where the MSC 120 is located. This is referred 
to as registration notification. The MSC 120 receives the 
radio signal 220 as a registration notification (REGNOT) 
query. A REGNOT query includes a MIN, a time stamp 
representing a time when the registration notification was 
Additionally, the left-most digit(s) of a reference number 30 received by the MSC 120, and an originating MSC indicia 
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identifies the drawing in which the reference number first 
appears. 

FIG. 1 illustrates a cellular mobile telephone environ- 
ment; 

FIG. 2 illustrates a block diagram of a cellular mobile 35 
telephone system according to a preferred embodiment of 
the present invention; 

FIG. 3 illustrates a block diagram of a clone detection 
system (CDS) according to a preferred embodiment of the 
present invention; 

FIGS. 4 and 5 are flow charts depicting the preferred 
operation of the present invention; and 

FIG. 6, illustrates an example clone detection table used 
by the invention. 

DETAILED DESCRIPTION OF THE 
EMBODIMENTS 

FIG. 1 illustrates a cellular mobile telephone environment 



identifying which MSC 120 received the registration noti- 
fication. The MSC 120 sends the REGNOT query to one of 
the RVCDs 204 which processes the REGNOT query and 
creates a record of the query for subsequent retrieval by 
PSMS 202 (described below). 

For example, at 10:30 am, a mobile user 130G operating 
in a cell HOG sends a radio signal 220 containing a 
registration notification. The MSC 120G receives the signal 
220 and creates a REGNOT query. The REGNOT query 
40 includes the mobile user 130G's MIN, a time stamp of 10:30 
am (i.e., the time when the registration notification was 
received), and an originating MSC indicia identifying MSC 
120G (i.e., the identity of the MSC receiving the registration 
notification). The REGNOT query is sent to either RVCD 
45 204A or RVCD 204B which stores the query as a REGNOT 
record. 

As discussed previously, each RVCD 204 functions as a 
clearing house for the cellular mobile telephone system 200 



by maintaining information regarding the mobile users 130. 

100. Cellular mobile telephone environment 100 includes a so This information includes the cellular mobile telephone 

plurality of cells 110. Each cell 110 includes a base station services to which each mobile user 130 subscribes and the 

(not shown) for transmitting and receiving radio signals to cell where each operating mobile user 130 is currently 

and from mobile users 130. Each base station is connected located. RVCDs 204 maintain this information in a master 

to a mobile switching center (MSC) 120. One or more list referred to as a Home Location Register (HLR). The 

mobile users 130 may be positioned in each cell 110 at any ss information regarding the cell where each operating mobile 

time. For ease of discussion, it is assumed that each MSC user 130 is currently located is updated from REGNOT 

120 is connected to one base station, and that each MSC 120 queries received from the MSCs 120. At a predetermined 

covers one cell 110. However, it will be apparent to one time interval (i.e. determined by individual system imple- 

skilled in the art that such a limitation is unnecessary. In fact, mentation requirements), each RVCD 204 sends the REG- 

each MSC 120 is usually connected to several base stations, 60 NOT records to the PSMS 202 which performs various 

and thus, is responsible for covering multiple cells 110. processing of the information. The PSMS 202 includes a 

FIG. 2 illustrates a block diagram of a cellular mobile clone detection system (CDS) 210 which processes the 

telephone system 200 according to a preferred embodiment REGNOT records to identify instances of cloning fraud, 

of the present invention. Cellular mobile telephone system FIG. 3 illustrates a block diagram of the clone detection 

could comprise a nationwide telephone system. Cellular 65 system (CDS) 210 according to a preferred embodiment of 

mobile telephone system 200 includes a PCS Service Man- the present invention. The CDS 210 includes a REGNOT 

agement System (PSMS) 202, a first Roamer Validation and record collector 302, a REGNOT record file 312, a fraud 
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manager 304, a clone detection time table 306, a clone The previous example has been provided to illustrate the 

detection window 308, a clone record file 314, and a report operation of the clone detection system 210 and not as a 

generator 316. limitation. In the preferred embodiment, the clone detection 

The PSMS 202 receives the REGNOT records, indicated window 308 is 6.5 hours wide (chosen as the minimum 

by reference number 318 in FIG. 3, from the RVCDs 204. 5 reasonable time to travel across the United States) and 

The REGNOT record collector 302 collects these REGNOT encompasses a much larger time frame than the example 

records 318 and stores them in the REGNOT record file 312. illustrates. Furthermore, it would be apparent for one skilled 

In the preferred embodiment, the PSMS 202 receives new in the art to adjust the width of the clone detection window 

REGNOT records 318 from the RVCDs 204 every thirty 308 depending on the geographic area covered by the 

minutes. The REGNOT records 318 received during each ™ cellular mobile telephone system 200. 

thirty minute interval are stored in the REGNOT record file Referring again to FIG. 3, in the preferred embodiment, 

312 as a group. Each group of REGNOT records 318 so reasonable travel times between the cells 110 covered by 

stored is referred to as a "half hour data group" 310. different MSCs 120 of the cellular mobile telephone system 

Fraud manager 304 collects several half hour data groups 2W) are stored in a clone detection time table 306. The clone 

310 from the REGNOT record file 312 and forms a clone 15 detection time table 306 includes the reasonable travel time 

detection window 308 (such half hour data groups 310 are between cells 110 covered by a pair of MSCs 120. For cells 

stored in memory, such as random access memory). The 110 covered by a pair of adjacent MSCs 120 (e.g., MSC 

clone detection window 308 collectively represents all reg- 120A and MSC 120B), the travel time is zero because a 

istration notifications (represented by REGNOT records mobile user 130 could register with either MSC 120 as the 

318) received by the MSCs 120 within the cellular mobile 20 mobile user 130 crosses cell boundaries. For each pair of 

telephone system 200 during a predetermined time frame. In nonadjacent MSCs 120 (e.g., MSC 110A and MSC HOD), 

the preferred embodiment, the fraud manager 304 forms a a reasonable travel time is determined based on the time a 

clone detection window 308 from the most recent thirteen mobile user 130 would take to travel out of cells 110 covered 

half hour data groups 310 arranged from oldest in time to *>y a first MSC 120 and into cells 110 covered by a second 

newest in time. Accordingly, the clone detection window 25 MSC ^0. This reasonable travel time is stored in clone 

308 represents all registration notifications received within detection time table 306 and is retrieved using the originat- 

the past 6.5 hours by all MSCs 120 in the cellular mobile irig MSC from each of the REGNOT records as indices into 

telephone system 200. me table. An example clone detection time table 306 is 

^ j . • , . „ .... „*„j«,„ illustrated in FIG. 6. For example, the reasonable travel time 

Clone detection window 308 is a sliding window, repre- _ n , „ . , r '~ ~ , - ™^ • 

senting registration notifications occurring within a specified 30 ceUs ™ ™*£ r #™?*. ^fiL 

time interval (i.e. the last 6.5 hours). As the window "slides" f ° und *^ N0T ° ngm ^ MS 5^ n 

(i.e. time passes), new registration notifications are added to and ^ second REGNOT originating MSC as MSC D to 

the window and old ones are removed. Thus, only those retrieve 120 miDUtes " lhe reasonable travel time. 

registration notifications occurring within the specified time The preferred embodiment uses RVCDs 204 to store the 

interval are processed together by fraud manager 304. HLR and collect the REGNOT queries for each of the MSCs 

-me fraud manager 304 determines whether cloning fraud U0 ; 0ne skiUed » the art , would recognize that other 

exists by determining whether time-space peculiarities exist implementations or divisions j of processing oould be utilized 

within the clone detection window 308. A time-space pecu- for elone detection system 210. For example the PSMS 202 

liarity exists when registration notifications with the same 40 cou |d be directly connected to each MSC 110 ano^andle the 

MIN originated in different locations within a time insuffi- registration notifications without any RVCDs 204. 

cient to travel between the different locations. In such cases, Furthermore, data could be processed in other that half hour 

at least one of the registration notifications is likely to be an increments, or in fact, immediately upon recent, 

instance of cloning fraud, FIG * 4 illustrates a flow diagram of a preferred imple- 

In the preferred embodiment, the fraud manager 304 45 ™™ X f on of 1 the P' ocessin g perfonned by the fraud manager 

detects cloning fraud by comparing the difference between ^04 during clone detection. In a step 402 the fraud manager 

the time stamps of the REGNOT records 318 in the clone 304 forms a done detection window 308 from preferably the 

detection window 308 having the same MIN with a reason- most re ?% nt in ' ha } f *™ data A ^ U P S 31 ° 

able travel time between the locations of the cells of the r f ieve ? * om REGNOT record fi e 312. As discussed 

originating MSCs. For example, referring to FIG. 1, suppose 50 abc ? e ' the dato * ^ the ° ldeSt ^ GN0T record 

the MSC 120A receives a registration notification indicating 10 ihc newest REGN0T rccord - 

a MIN of X from the mobile user 130A at 10:00 a.m. Later, ln a step 404, the fraud manager 304 reads a MIN from 

the MSC 120C receives a registration notification also a firsl REGNOT record 318, (i.e., the oldest record with 

indicating a MIN of X from the mobile user 130C at 10:45 respect to time) in the clone detection window 308. In a step 

a.m. Suppose that a reasonable travel time between cell 55 406 > &e fraud manager 304 reads a MIN from a second 

110A and cell HOC is 80 minutes. When the fraud manager REGNOT record 318 in clone detection window 308. In a 

304 processes the REGNOT records 318 in the clone detec- decision step 408, the fraud manager 304 compares the MIN 

tion window 310, it will locate these two registration noti- from the REGNOT record with the MIN from the 

fications having the same MIN of X. The fraud manager 304 second REGNOT record to determine if the MINs are the 

will determine that one registration notification was received 60 same - If me MINs are the same (indicating the same 

by the MSC 120A in cell 110A while the other was received registered mobile user), processing continues at a step 410; 

by the MSC 120C in cell HOC. The fraud manager 304 will otherwise, processing continues at a decision step 414. 

determine that the registration notifications occurred 45 In step 410, the fraud manager 304 handles a possible 

minutes apart from one another. By comparing this time clone detection, as discussed in greater detail below. After 

difference (45 minutes) with the reasonable travel time (80 65 handling a possible clone detection, the fraud manager 304, 

minutes), the fraud manager 304 will conclude that an in a step 412, notes that it should use the second REGNOT 

instance of cloning fraud has occurred. record in place of the first REGNOT record in future 
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performances of step 408 and 410, so that future occurrences (3) computing a time difference between time stamps of 
of the same MIN will be compared (in step 502, as described said first and second REGNOT records; and 
below) with the time stamp of the second REGNOT record (4) determining whether cloning fraud involving said 
rather than that of the first. common MIN has occurred based on said time differ- 
In decision step 414, the fraud manager 304 determines 5 ence. 
whether the entire clone detection window 308 has been 2. The method of claim 1, wherein step (4) comprises the 
searched for the occurrence of the MIN obtained in step 404. step of comparing said time difference to a clone detection 
If the entire clone detection window 308 has been searched, time corresponding to a time needed to travel between cells 
processing continues at a step 416; otherwise, processing identified by originating indicias contained in said first and 
returns to step 406 to get a new second REGNOT record 318 1Q second REGNOT records. 

from the clone detection window 308 and continue search- 3. The method of claim 2, wherein said clone detection 

ing for the same MIN. time is stored in a clone detection time table and retrieved 

In step 416, the fraud manager 304 excludes from further using said originating indicias contained in said first and 

consideration all REGNOT records 318 having the MIN second REGNOT records as indices into said clone detec- 

obtained in step 404, In a step 418, the fraud manager 304 tion time table. 

determines whether any REGNOT records 318 remain in the 4. The method of claim 1, wherein the plurality of 

clone detection window 308 that contain MINs that have not REGNOT records are received from a plurality of RVCDs. 

yet been checked for cloning fraud. If no REGNOT records 5 - A meth ? d fo / proactively detecting cloning fraud in a 

318 remain to be checked, processing ends in a step 420; moblle <* m ™ telephone environment, comprising the steps 

otherwise, processing returns to step 404 to get a new first ot: 

REGNOT record 318 containing a new MIN to check for 20 0) storin g a plurality of registration notifications each 

cloning fraud represented by a registration notification (REGNOT) 

FIG, 5 illustrates the handling of possible clone detection > each REGNOT record comprising a mobile 

of step 410 in greater detail. In a step 502, the fraud manager identification number (MIN), a time stamp of said 

304 computes a difference between time stamps of the first „ registration notification, and originating indicia identi- 

and second REGNOT records. In a step 504, the fraud 25 a cel1 where said registration notification ongi- 

manager 304 obtains the indicia identifying the originating nated; 

MSCs from the first and second REGNOT records and uses ( 2 ) forming a clone data window comprising a plurality of 

them as indices to the clone detection time table 306 to sa j d REGNOT records occurring within a predeter- 

retrieve a reasonable travel time between the respective cells 3Q mined time frame; 

of originating MSCs. In a decision step 506, the fraud (3) detecting in said clone data window a first REGNOT 
manager 304 determines whether the time stamp difference record and a second REGNOT record having a corn- 
obtained in step 502 is less than the reasonable travel time mon MIN; 

obtained from the clone detection time table 308 in step 504. (4) computing a time difference between time stamps of 

If the time stamp difference is less than the reasonable travel 35 said first and second REGNOT records; 

time, then cloning fraud is likely to exist and processing (5) determining whether cloning fraud involving said 

continues at a step 508; otherwise, the handling of possible common MIN has occurred based on said time differ- 

clone detection is complete (i.e., cloning fraud does not ence; and 

exist) and processing continues at step 412. (6) recording said occurrence of cloning fraud involving 

In step 508, the fraud manager 304 records a likely 40 said common MIN. 

instance of cloning fraud in the clone record file 314. The 6. The method of claim 5, wherein step (5) comprises the 

fraud manager stores the MIN, both originating MSCs, the step of comparing said time difference to a clone detection 

clone detection time, and the time stamp difference for later time corresponding to a time needed to travel between cells 

action/reporting by the clone detection system 210, In addi- identified by originating indicias contained in said first and 

tion to a daily report of cloning activity, such action/ 45 second REGNOT records. 

reporting may include an alarm displayed to personnel in 7. The method of claim 6, wherein said clone detection 

cellular mobile telephone system 200 or removal of the time is stored in a clone detection time table and retrieved 

suspected clone from service. After step 508, processing using said originating indicias contained in said first and 

continues at step 412. second REGNOT records as indices into said clone detec- 

While the invention has been particularly shown and 50 tion time table, 

described with reference to several preferred embodiments 8. The method of claim 7, wherein said clone detection 

thereof, it will be understood by those skilled in the art that window is formed every 30 minutes and said predetermined 

various changes in form and details may be made therein time frame is the previous 6.5 hours, 

without departing from the spirit and scope of the invention 9. The method of claim 5, wherein the plurality of 

as defined in the appended claims. 55 REGNOT records are received from a plurality of RVCDs. 

What is claimed is: 10. A computer-based system for proactively detecting 

1. A method for proactively detecting cloning fraud in a cloning fraud in a mobile cellular telephone environment, 

mobile cellular telephone environment, comprising the steps comprising: 

of: storing means for storing a plurality of registration noti- 

(1) collecting a plurality of registration notifications each 60 fications each represented by a registration notification 
represented by a registration notification (REGNOT) (REGNOT) record, each REGNOT record comprising 
record comprising a mobile identification number a mobile identification number (MIN), a time stamp of 
(MIN), a time stamp of said registration notification, said registration notification, and originating indicia 
and originating indicia identifying a cell where said identifying a cell where said registration notification 
registration notification originated; 65 originated; 

(2) detecting a first REGNOT record and a second REG- delecting means for detecting a first REGNOT record and 
NOT record having a common MIN; a second REGNOT record having a common MIN; 
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computing means for computing a time difference 
between time stamps of said first and second REGNOT 
records; 

means for determining whether cloning fraud involving 
said common MIN has occurred based on said time 5 
difference; and 

reporting means for reporting said occurrence of cloning 
fraud involving said common MIN. 

11. The system of claim 10, wherein said means for 
determining cloning fraud comprises comparing said time 10 
difference to a clone detection time corresponding to the 
time needed to travel between cells identified by originating 
indicias contained in said first and second REGNOT records. 

12. The system of claim 11, wherein said clone detection 
time is stored in a clone detection time table and retrieved 15 
using said originating indicias contained in said first and 
second REGNOT records as indices into said clone detec- 
tion time table. 

13. The system of claim 10, further comprising means for 
accepting a plurality of REGNOT records from a plurality of 20 
RVCDs. 

14. A method for proactively detecting cloning fraud in a 
mobile cellular telephone environment, comprising the steps 
of: 

25 

receiving a plurality of registration notifications each 
having a mobile identification number for identifying a 
mobile user in the mobile cellular telephone environ- 
ment; 

obtaining a time stamp and an originating indicia for each 30 
of said plurality of registration notifications, wherein 
said time stamp indicates when and said originating 
indicia indicates where each of said plurality of mobile 
identification numbers was received; and 

determining whether an instance of cloning fraud has 35 
occurred based on said time stamps and said originating 
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indicias of two of said plurality of registration notifi- 
cations having a same mobile identification number. 

15. The method of claim 14, wherein said step of deter- 
mining comprises: 

computing a time difference between time stamps of said 
two of said plurality of registration notifications having 
the same mobile identification number; and 

comparing said time difference to a time needed to travel 
between said cells indicated by said originating indi- 
cias. 

16. The method of claim 14, wherein the plurality of 
REGNOT records are received from a plurality of RVCDs. 

17. A method for detecting cloning fraud in a mobile 
telephone environment, comprising the steps of: 

receiving a plurality of registration notification each iden- 
tifying a same particular mobile user; and 

determining, as a function of a time of creation of each of 
said plurality of registration notifications and a location 
identified as the location of a mobile telephone that 
caused the creation of each of said plurality of regis- 
tration notifications, whether an instance of cloning 
fraud has occurred. 

18. The method of claim 17, wherein the plurality of 
REGNOT records are received from a plurality of RVCDs. 

19. A method for detecting cloning fraud in a mobile 
telephone environment, comprising the steps of: 

receiving a plurality of registration notifications identify- 
ing a same particular mobile user; 

obtaining a creation time and an originating location for 
each of said plurality of registration notifications; and 

determining whether cloning fraud has occurred based on 
said creation times and said originating locations. 

20. The method of claim 19, wherein the plurality of 
REGNOT records are received from a plurality of RVCDs. 

***** 
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